APIM error with managed certificate - Failed to update API Management service hostnames

Hello Rodolfo Grave,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your APIM error with managed certificate - Failed to update API Management service hostnames.

For more clarification regarding your issue, managed certificate renewal failed due to new DigiCert validation requirements and platform transition. Because Azure changed validation rules and your configuration no longer satisfies the requirements. You will need to fix network and DNS validation requirements (port 80, DigiCert access, CAA), then force certificate revalidation (remove/re-add domain); otherwise use a custom certificate as immediate recovery.

• Verify failure by checking CN mismatch (*.azurewebsites.net) and unbound managed cert, then correct validation requirements: open port 80, allow DigiCert IPs in NSG/WAF, and ensure DNS resolves correctly. Add a required CAA record: CAA 0 issue "digicert.com" to permit issuance Microsoft Docs – Custom domain & cert requirements, Managed cert changes.
• Force renewal by removing and re-adding the custom domain in APIM (Option A), or retry after service restoration timelines if blocked (Option B). After rebind, confirm the certificate CN matches your domain and test via browser or curl -v https://yourdomain to ensure TLS is correctly served Microsoft Docs – Configure custom domains.
• If renewal still fails, raise a support request due to possible backend state issues, and immediately switch to a customer-managed certificate (e.g., Azure Key Vault integration) to restore service. This avoids downtime during platform transition and aligns with Microsoft’s recommended production approach Microsoft Docs – Use Key Vault certificates.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Hi @Rodolfo Grave

Thank you for reaching out to Microsoft Q&A.

Backend Engineering team has confirmed this issue is caused by a bug and they are still investigating, but they have provided below resolution for your issue:

For service "rsi-api" I saw customer changed to use their own certificate instead of free certificate, so nothing I can do here to change back for them to keep using free certificate.  For service "nemsprdwebappp0apimngt", I manually fix the custom domain issue, their custom domain should be able to use already with free certificate.